Unauthorized Data Modification Vulnerability in Metasync Plugin for WordPress

CVE-2026-15947

What is CVE-2026-15947?

The Metasync plugin for WordPress has a vulnerability that allows unauthorized modifications of data due to a lack of proper capability checks in its save_instant_indexing_settings() function. This issue affects versions up to and including 2.6.23. The function, which is triggered on the admin_init hook, only verifies the presence of a $_POST['submit'] parameter before processing user-supplied $_POST['metasync_post_types']. As there are no checks via current_user_can() or nonce verification, this vulnerability permits authenticated users with Subscriber-level access or higher to alter site configurations related to Google Instant Indexing. This could lead to unauthorized control over what content is submitted for indexing on Google, thus posing a serious security risk.

References